Passkey Registration Keeps Failing? Three Questions Find the Cause

Phishing-resistant MFA is the right destination for every Microsoft 365 tenant. The trouble starts at the helpdesk, where passkey tickets arrive with vague symptoms: the option to add a passkey never shows up, Authenticator throws a generic error, a QR code goes nowhere, or a user swaps phones and their passkey is gone.

The same handful of causes sit behind almost all of them. This guide groups them by where they come from (policy, Conditional Access, the device, or recovery) so your techs can get from symptom to fix quickly.

Three questions that narrow every passkey ticket#

Before opening a single admin portal, get answers to these:

1. What passkey or credential type is the user trying to register or use?
2. Where is it happening: which device, browser, or app?
3. When does it fail: before registration, during registration, or at sign-in?

Those answers usually point straight at one of the sections below.

Fewer credential types means fewer tickets#

The most effective troubleshooting step happens before anyone calls in. Windows Hello for Business, Microsoft Authenticator, synced passkeys, and FIDO2 security keys each come with their own registration requirements, device dependencies, and recovery process. Every one you allow is another support journey your team has to document.

For most organizations, we recommend this baseline:

• Managed Windows: Windows Hello for Business
• Managed Macs: Platform SSO
• Mobile: device-bound passkeys in Microsoft Authenticator

The tighter the list, the simpler your helpdesk procedures.

Is the passkey policy rejecting the user?#

Two of the most common tickets come from a mismatch between the user and their assigned passkey profile.

The Add passkey option never appears#

The user opens their Security Info page and there is no passkey option at all. That almost always means the user is not assigned to an enabled passkey profile.

To check:

1. Open Entra ID → Authentication methods → Policies → Passkey (FIDO2).
2. Confirm the policy is enabled and self-service setup is allowed.
3. Review which groups are assigned to your passkey profiles.
4. Confirm the user belongs to one of those groups and is not excluded.

A frequent cause is targeting users with a registration campaign without also assigning them an enabled passkey profile.

To fix it, correct the group assignment and have the user try again at https://mysignins.microsoft.com/security-info (opens in new tab).

"Passkey not registered" after the user picks a provider#

Here the user gets through the prompts and then hits the generic "Passkey Not Registered" error.

A typical example: the user saves a synced passkey in LastPass, but their assigned profile only allows device-bound credentials. The browser or password manager happily offers to create the passkey, and Microsoft Entra rejects it because it does not match the policy.

Work through these checks:

• Which passkey profile is the user assigned?
• Does that profile allow device-bound passkeys, synced passkeys, or both?
• Are AAGUID restrictions or attestation requirements in place?
• Which passkey provider did the user pick?
• Was the user in a private browsing window, or did the registration session expire?

The fix is to have the user register a credential type their profile supports. If you have standardized on Microsoft Authenticator, have users register directly inside the Authenticator app. That removes the provider-selection step where most of these errors start.

Is Conditional Access blocking the registration itself?#

When Microsoft Authenticator reports "We ran into an error" and says it couldn't add the account, a Conditional Access registration loop is one of the biggest causes.

Two policy types tend to cause it:

• Require phishing-resistant MFA applied to all resources, when the user has not registered a phishing-resistant method yet.
• Require app protection policy applied to all resources, which blocks registration because Microsoft Authenticator cannot meet that requirement for this flow.

Either way, the policy asks the user to meet a requirement they cannot meet until registration succeeds.

Find the policy that failed#

1. Open Entra ID → Monitoring & health → Sign-in logs.
2. Find the user's sign-in around the time registration failed.
3. Open the event and go to the Conditional Access tab.
4. Identify the failing policy and review its target resources and grant controls.

Exclude Microsoft Authenticator Credential Registration#

Microsoft added a dedicated resource, Microsoft Authenticator Credential Registration, that you can exclude from the policies causing the loop. That is a narrower fix than temporarily excluding the user from the whole policy.

You may need to provision the Microsoft-managed enterprise application in the tenant first.

1. Open PowerShell 7 as Administrator.
2. Install and import the Microsoft Graph Applications module. If it is already installed, you only need the import.

Install-Module Microsoft.Graph.Applications -Scope CurrentUser
Import-Module Microsoft.Graph.Applications

1. Connect to Microsoft Graph, replacing <TenantID> with your Microsoft Entra tenant ID. Sign in with an account that holds a suitable role, such as Cloud Application Administrator or Application Administrator.

Connect-MgGraph -Scopes "Application.ReadWrite.All" -TenantId "<TenantID>"

1. Create the service principal for the enterprise application. If it already exists, skip this step.

New-MgServicePrincipal -AppId "6aa00308-ea33-4caa-90d6-ae905d8cb51b"

1. Exclude the resource from the policy:
   1. Go to Entra ID → Protection → Conditional Access → Policies.
   2. Open the policy creating the loop.
   3. Under Target resources, find the resource exclusions.
   4. Select Microsoft Authenticator Credential Registration.
   5. Save, then have the user try registration again.

Know the limits of this exclusion. It covers registration through the Microsoft Authenticator app only. It does not resolve other authentication requirements, including policies that target Register security information. Users who register from their Security Info page may still need a controlled bootstrap, such as a temporary Conditional Access exclusion or a policy that permits a Temporary Access Pass.

Microsoft documents the new resource as available beginning in November 2026, so confirm it shows up in your tenant before you plan around it.

Microsoft reference: Enable and support passkeys in Microsoft Authenticator (opens in new tab)

Is it the device or the connection?#

If the Entra configuration checks out and registration still fails, look at the hardware and the link between devices.

QR code and cross-device registration#

When a user scans a QR code on their computer to register or use a passkey on their phone, two causes are worth checking.

Bluetooth and connectivity. Cross-device passkey authentication needs Bluetooth turned on and an active internet connection on both devices. If either device has Bluetooth off, the handshake can fail. Check both devices first. If connectivity still fails, look at network restrictions that affect cross-device passkey authentication.

Attestation. If the passkey profile enforces attestation, it can limit which Microsoft Authenticator registration flows work. Registering directly inside the Authenticator app is the most reliable route, especially on iOS. Android support varies by registration flow and platform version. Review the profile's attestation settings and have the user register inside Microsoft Authenticator.

Hardware and software requirements#

Passkeys depend on hardware and software that not every device has. When the configuration is correct and registration still fails, check:

• iOS or Android version
• Microsoft Authenticator version
• Secure hardware availability
• Android work profile configuration
• Browser and operating system compatibility

As of November 2026, Microsoft Authenticator passkeys generally need iOS 17 or later or Android 14 or later, plus compatible security hardware. Update the device or app where you can. Where the hardware cannot support passkeys, give the user an approved alternative credential.

One Windows Hello for Business note: users often confuse their Windows Hello PIN with their Microsoft 365 password. Document a PIN reset process and explain to users that the PIN belongs to the device.

What happens when a user replaces their phone?#

The user gets a new phone, restores Microsoft Authenticator, and the passkey is missing. That is expected. Authenticator passkeys are device-bound and cannot be restored from an Authenticator backup. Synced passkeys behave differently and may be recoverable through the user's credential provider.

Give your helpdesk a standard recovery procedure:

1. Verify the user's identity through your approved helpdesk process.
2. Check their existing authentication methods for a usable backup.
3. Issue a Temporary Access Pass (TAP) if they need one.
4. Have the user register a new passkey on the replacement device.
5. Confirm they can sign in, then remove the old credential from Entra.

Plan recovery around your Conditional Access policies#

A common snag is a Conditional Access policy requiring MFA for the Register security information user action. A user who has lost their only usable method cannot satisfy that requirement to register a replacement.

A TAP can bootstrap recovery because it satisfies standard MFA requirements, as long as the user and policy configuration allow it. It does not satisfy a phishing-resistant authentication strength. If you enforce phishing-resistant MFA across resources, set up a controlled recovery path that lets users register a replacement credential without weakening normal sign-in requirements.

Microsoft reference: Configure Temporary Access Pass (opens in new tab)

Make the fixes repeatable#

Passkey support gets easier once it stops being improvised. Standardize the credential types you allow, then write down a procedure for each failure point above: profile assignment, Conditional Access registration loops, device requirements, and lost-phone recovery. Your techs will start every ticket with the same three questions and end most of them in minutes.